Report - channeldrag.com/c4210c29?dev=r&key=01f75a95a38a8db0a8e82d995253a076&kw=["getfreedays","com","cruel","anette","-","sex","slave","used","sex","video","november","2022","thefantazy","com"]&psid=CF-3363_new_0&refer=https://thefantazy.com/video/6604c1816e88395d7c5d9688&res=14.31&scrHeight=999&scrWidth=1924&ship=&sub3=invoke

Report Overview

Visited public
2024-03-31 10:12:28
Tags
URL
channeldrag.com/c4210c29?dev=r&key=01f75a95a38a8db0a8e82d995253a076&kw=["getfreedays","com","cruel","anette","-","sex","slave","used","sex","video","november","2022","thefantazy","com"]&psid=CF-3363_new_0&refer=https://thefantazy.com/video/6604c1816e88395d7c5d9688&res=14.31&scrHeight=999&scrWidth=1924&ship=&sub3=invoke_layer&tz=2&v=24.3.3460&xjnryv=13
Finishing URL
best-free-apps.com/preland/other/main/confirm/2/index.html?c=10378&u=28&p1=https%3A%2F%2Foohirdoadi.com%2Fdating-survey.html%3Fvar_3%3D377377824673a1ed2e720d2aa93c4abd%26ymid%3D1009861%26var%3D17663689%26testinapp%3D4455851%26geo%3D%257Bgeo%257D%26offer_id%3D2061%26b%3D20601807%26z%3D7251003%26nwimpr%3D1
IP / ASN
172.240.253.132
#7979 SERVERS-COM
Title
Confirm

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
channeldrag.com	unknown	unknown	No data	No data	3.3 kB	4.7 kB	192.243.59.13
best-free-apps.com	172446	2021-08-27	2019-05-27 10:43:09	2024-03-30 20:59:46	3.0 kB	25 kB	104.21.62.29
locusflourishgarlic.com	unknown	2023-09-07	2023-09-14 04:01:17	2024-03-27 07:53:49	452 B	467 B	172.240.127.234

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-03-31	medium	channeldrag.com	Sinkholed
2024-03-31	medium	channeldrag.com	Sinkholed
2024-03-31	medium	locusflourishgarlic.com	Sinkholed

ThreatFox

No alerts detected

JavaScript (4)

	URL	From	Size	First Seen	Last Seen
	best-free-apps.com/preland/other/main/confirm/2/index.html?c=10378&u=28&p1=https%3A%2F%2Foohirdoadi.com%2Fdating-survey.html%3Fvar_3%3D377377824673a1ed2e720d2aa93c4abd%26ymid%3D1009861%26var%3D17663689%26testinapp%3D4455851%26geo%3D%257Bgeo%257D%26offer_id%3D2061%26b%3D20601807%26z%3D7251003%26nwimpr%3D1	ScriptElement	2.9 kB	2024-03-30	2024-08-20
Pretty URL best-free-apps.com/preland/other/main/confirm/2/index.html?c=10378&u=28&p1=https%3A%2F%2Foohirdoadi.com%2Fdating-survey.html%3Fvar_3%3D377377824673a1ed2e720d2aa93c4abd%26ymid%3D1009861%26var%3D17663689%26testinapp%3D4455851%26geo%3D%257Bgeo%257D%26offer_id%3D2061%26b%3D20601807%26z%3D7251003%26nwimpr%3D1 IP 104.21.62.29 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2024-03-30 01:06 Last Seen2024-08-20 06:41 Times Seen91 Hash e8472f455c108b94587912042d7ec8e9 7ac2dd8be2bd673b7204f0bed01985da2c9aa491 864bef8162b843ac209e91946d87a550be52dd2460138e3f8c68cf117d075eff Loading...

	best-free-apps.com/preland/other/main/confirm/2/index.html?c=10378&u=28&p1=https%3A%2F%2Foohirdoadi.com%2Fdating-survey.html%3Fvar_3%3D377377824673a1ed2e720d2aa93c4abd%26ymid%3D1009861%26var%3D17663689%26testinapp%3D4455851%26geo%3D%257Bgeo%257D%26offer_id%3D2061%26b%3D20601807%26z%3D7251003%26nwimpr%3D1	ScriptElement	1.1 kB	2024-03-30	2024-08-20
Pretty URL best-free-apps.com/preland/other/main/confirm/2/index.html?c=10378&u=28&p1=https%3A%2F%2Foohirdoadi.com%2Fdating-survey.html%3Fvar_3%3D377377824673a1ed2e720d2aa93c4abd%26ymid%3D1009861%26var%3D17663689%26testinapp%3D4455851%26geo%3D%257Bgeo%257D%26offer_id%3D2061%26b%3D20601807%26z%3D7251003%26nwimpr%3D1 IP 104.21.62.29 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2024-03-30 01:06 Last Seen2024-08-20 06:41 Times Seen95 Hash a1907185cc79e6d7c9a25f0b695c28a9 80e7172f04792ec05a6be9273f6abff8d29b110b f99bfad417e99a461f9f1472777f1d28cd545259e4e8737a822200c272818368 Loading...

	unknown	EventHandler	29 B	2023-10-20	2025-03-23
Pretty Introduced by eventHandler Embedded in HTML false Observations First Seen2023-10-20 18:51 Last Seen2025-03-23 19:54 Times Seen348 Hash f43bc2d45661d975eaeae1bf81070ed6 2ce38cfcd1d6959d8ae1525cf1ed7351376e6fdb 65a181304273b279f1962ca78052297016d760707becfc66780d1c1dd85d7943 Loading...

	best-free-apps.com/preland/other/main/confirm/2/index.html?c=10378&u=28&p1=https%3A%2F%2Foohirdoadi.com%2Fdating-survey.html%3Fvar_3%3D377377824673a1ed2e720d2aa93c4abd%26ymid%3D1009861%26var%3D17663689%26testinapp%3D4455851%26geo%3D%257Bgeo%257D%26offer_id%3D2061%26b%3D20601807%26z%3D7251003%26nwimpr%3D1	ScriptElement	7.7 kB	2024-03-30	2025-01-31
Pretty URL best-free-apps.com/preland/other/main/confirm/2/index.html?c=10378&u=28&p1=https%3A%2F%2Foohirdoadi.com%2Fdating-survey.html%3Fvar_3%3D377377824673a1ed2e720d2aa93c4abd%26ymid%3D1009861%26var%3D17663689%26testinapp%3D4455851%26geo%3D%257Bgeo%257D%26offer_id%3D2061%26b%3D20601807%26z%3D7251003%26nwimpr%3D1 IP 104.21.62.29 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2024-03-30 01:06 Last Seen2025-01-31 10:21 Times Seen106 Hash f854df9f5750491975d75422bf97dfe1 dbc742b64dd490a83b01e101b864bcac6c8a4cf8 37782bf62a05028ed07255f11e13bb45073e06dcda6401fc4193285ca30211fa Loading...

HTTP Transactions (7)

URL IP Response Size

channeldrag.com/c4210c29?dev=r&key=01f75a95a38a8db0a8e82d995253a076&kw=[%22getfreedays%22,%22com%22,%22cruel%22,%22anette%22,%22-%22,%22sex%22,%22slave%22,%22used%22,%22sex%22,%22video%22,%22november%22,%222022%22,%22thefantazy%22,%22com%22]&psid=CF-3363_new_0&refer=https://thefantazy.com/video/6604c1816e88395d7c5d9688&res=14.31&scrHeight=999&scrWidth=1924&ship=&sub3=invoke_layer&tz=2&v=24.3.3460&xjnryv=13

192.243.59.13

1.7 kB

URL
channeldrag.com/c4210c29?dev=r&key=01f75a95a38a8db0a8e82d995253a076&kw=[%22getfreedays%22,%22com%22,%22cruel%22,%22anette%22,%22-%22,%22sex%22,%22slave%22,%22used%22,%22sex%22,%22video%22,%22november%22,%222022%22,%22thefantazy%22,%22com%22]&psid=CF-3363_new_0&refer=https://thefantazy.com/video/6604c1816e88395d7c5d9688&res=14.31&scrHeight=999&scrWidth=1924&ship=&sub3=invoke_layer&tz=2&v=24.3.3460&xjnryv=13
IP
192.243.59.13:0
ASN
#39572 DataWeb Global Group B.V.

File type
HTML document, ASCII text, with very long lines (919)
Size
1.7 kB (1678 bytes)
Hash
94753992ac1364fe56f0974c7dc7b39d
de3f16d55ad88ad9e5c8a8bd4db97ca6a6639624
01e0a58bf0aa1c228b51a41ab1b28a339b184c34dd058f7c337a522cdcc3d3aa

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /c4210c29?dev=r&key=01f75a95a38a8db0a8e82d995253a076&kw=[%22getfreedays%22,%22com%22,%22cruel%22,%22anette%22,%22-%22,%22sex%22,%22slave%22,%22used%22,%22sex%22,%22video%22,%22november%22,%222022%22,%22thefantazy%22,%22com%22]&psid=CF-3363_new_0&refer=https://thefantazy.com/video/6604c1816e88395d7c5d9688&res=14.31&scrHeight=999&scrWidth=1924&ship=&sub3=invoke_layer&tz=2&v=24.3.3460&xjnryv=13 HTTP/1.1
Host: channeldrag.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sun, 31 Mar 2024 10:12:04 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Set-Cookie: u_pl=17663689; expires=Mon, 01 Apr 2024 10:12:04 GMT
ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxNzY2MzY4OSwiayI6IjAxZjc1YTk1YTM4YThkYjBhOGU4MmQ5OTUyNTNhMDc2Iiwic2lkIjoiQ0YtMzM2M19uZXdfMCIsImlzaWQiOjIsImFzaWQiOjEsInppZCI6MTk3OTY1OSwicGlkIjo1NDA2MDgsImFuIjp0cnVlLCJsYW4iOnRydWUsImNpZCI6MTYsImFpZCI6MjgsInB0Ijo0LCJwayI6ImM0MjEwYzI5IiwidCI6MX0sInUiOnsidSI6MSwiYXUiOjEsImQiOnsiaWQiOjc5OTU0MTk2LCJpZHMiOiIiLCJpYyI6ZmFsc2UsIm4iOiJEZXNrdG9wLEVtdWxhdG9yIiwidiI6IlVua25vd24iLCJtIjoiVW5rbm93biIsImYiOjEsImZuIjoiRGVza3RvcCIsIm9pZCI6MTgxMTAsIm9uIjoiTGludXgiLCJvdiI6IlVua25vd24iLCJiaWQiOjExNjY3MCwiYm4iOiJGaXJlZm94IiwiYnYiOiI5Ni4wIiwid3YiOmZhbHNlLCJlIjpmYWxzZSwiYWIiOmZhbHNlfSwiYyI6eyJpZCI6MTYyLCJjIjoiTk8iLCJuIjoiTm9yd2F5In0sImEiOmZhbHNlLCJjciI6eyJuIjoiQmxpeCBTb2x1dGlvbnMifSwieGYiOiIiLCJpeGYiOmZhbHNlLCJpZ3hmIjpmYWxzZSwidXAiOnRydWUsInIiOiJodHRwczovL3RoZWZhbnRhenkuY29tL3ZpZGVvLzY2MDRjMTgxNmU4ODM5NWQ3YzVkOTY4OCIsImFyIjpbXX19.dt6MHvD0PdMJ_9EUz7VmH4zLzbtLb_0UIKlgYTmpL94; expires=Sun, 31 Mar 2024 10:13:04 GMT
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 055fc61574a158463c4591dae443d9df
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip

channeldrag.com/api/users?token=L2M0MjEwYzI5P2Rldj1yJmtleT0wMWY3NWE5NWEzOGE4ZGIwYThlODJkOTk1MjUzYTA3NiZrdz0lNUIlMjJnZXRmcmVlZGF5cyUyMiUyQyUyMmNvbSUyMiUyQyUyMmNydWVsJTIyJTJDJTIyYW5ldHRlJTIyJTJDJTIyLSUyMiUyQyUyMnNleCUyMiUyQyUyMnNsYXZlJTIyJTJDJTIydXNlZCUyMiUyQyUyMnNleCUyMiUyQyUyMnZpZGVvJTIyJTJDJTIybm92ZW1iZXIlMjIlMkMlMjIyMDIyJTIyJTJDJTIydGhlZmFudGF6eSUyMiUyQyUyMmNvbSUyMiU1RCZwc2lkPUNGLTMzNjNfbmV3XzAmcHN0PTE3MTE4Nzk5ODQmcmVmZXI9aHR0cHMlM0ElMkYlMkZ0aGVmYW50YXp5LmNvbSUyRnZpZGVvJTJGNjYwNGMxODE2ZTg4Mzk1ZDdjNWQ5Njg4JnJlcz0xNC4zMSZybXRjPXQmc2NySGVpZ2h0PTk5OSZzY3JXaWR0aD0xOTI0JnNoaXA9JnNodT04ZDAxNjQ3MjY4YjYwMjA3MGZhMTJmYWU0NmE3MjA2YjdmMzRmN2IzM2ZiODc4NzAxZTAwMTg3YmJhYjgxYjgzMGVjZmY3YjZhOTc3NTM0MTNjMWQ1OGQxOWIwNjU0NjE1NWQ2MTQxMDkyZWZkNDIyOWY4Yjk4MDYyYTZjOGQ5ZTkyMzNmNjU2ZjE4MmM4NGY5MTllZDk1NGNmNGU4MmYxNzdmMTFiYTRiZWY5YjZlMDRlZGI2NTQyZGEmc3ViMz1pbnZva2VfbGF5ZXImdHo9MiZ2PTI0LjMuMzQ2MCZ4am5yeXY9MTM&uuid=&pii=&in=false

172.240.108.68

302 Found

0 B

URL User Request GET HTTP/1.1
channeldrag.com/api/users?token=L2M0MjEwYzI5P2Rldj1yJmtleT0wMWY3NWE5NWEzOGE4ZGIwYThlODJkOTk1MjUzYTA3NiZrdz0lNUIlMjJnZXRmcmVlZGF5cyUyMiUyQyUyMmNvbSUyMiUyQyUyMmNydWVsJTIyJTJDJTIyYW5ldHRlJTIyJTJDJTIyLSUyMiUyQyUyMnNleCUyMiUyQyUyMnNsYXZlJTIyJTJDJTIydXNlZCUyMiUyQyUyMnNleCUyMiUyQyUyMnZpZGVvJTIyJTJDJTIybm92ZW1iZXIlMjIlMkMlMjIyMDIyJTIyJTJDJTIydGhlZmFudGF6eSUyMiUyQyUyMmNvbSUyMiU1RCZwc2lkPUNGLTMzNjNfbmV3XzAmcHN0PTE3MTE4Nzk5ODQmcmVmZXI9aHR0cHMlM0ElMkYlMkZ0aGVmYW50YXp5LmNvbSUyRnZpZGVvJTJGNjYwNGMxODE2ZTg4Mzk1ZDdjNWQ5Njg4JnJlcz0xNC4zMSZybXRjPXQmc2NySGVpZ2h0PTk5OSZzY3JXaWR0aD0xOTI0JnNoaXA9JnNodT04ZDAxNjQ3MjY4YjYwMjA3MGZhMTJmYWU0NmE3MjA2YjdmMzRmN2IzM2ZiODc4NzAxZTAwMTg3YmJhYjgxYjgzMGVjZmY3YjZhOTc3NTM0MTNjMWQ1OGQxOWIwNjU0NjE1NWQ2MTQxMDkyZWZkNDIyOWY4Yjk4MDYyYTZjOGQ5ZTkyMzNmNjU2ZjE4MmM4NGY5MTllZDk1NGNmNGU4MmYxNzdmMTFiYTRiZWY5YjZlMDRlZGI2NTQyZGEmc3ViMz1pbnZva2VfbGF5ZXImdHo9MiZ2PTI0LjMuMzQ2MCZ4am5yeXY9MTM&uuid=&pii=&in=false
IP
172.240.108.68:443
ASN
#7979 SERVERS-COM

Certificate
IssuerLet's Encrypt
Subjectchanneldrag.com
Fingerprint3B:D7:4B:6E:96:C3:1D:66:79:9C:28:D4:DB:A6:BA:DD:D3:CA:8D:C6
ValidityFri, 29 Mar 2024 08:30:58 GMT - Thu, 27 Jun 2024 08:30:57 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /api/users?token=L2M0MjEwYzI5P2Rldj1yJmtleT0wMWY3NWE5NWEzOGE4ZGIwYThlODJkOTk1MjUzYTA3NiZrdz0lNUIlMjJnZXRmcmVlZGF5cyUyMiUyQyUyMmNvbSUyMiUyQyUyMmNydWVsJTIyJTJDJTIyYW5ldHRlJTIyJTJDJTIyLSUyMiUyQyUyMnNleCUyMiUyQyUyMnNsYXZlJTIyJTJDJTIydXNlZCUyMiUyQyUyMnNleCUyMiUyQyUyMnZpZGVvJTIyJTJDJTIybm92ZW1iZXIlMjIlMkMlMjIyMDIyJTIyJTJDJTIydGhlZmFudGF6eSUyMiUyQyUyMmNvbSUyMiU1RCZwc2lkPUNGLTMzNjNfbmV3XzAmcHN0PTE3MTE4Nzk5ODQmcmVmZXI9aHR0cHMlM0ElMkYlMkZ0aGVmYW50YXp5LmNvbSUyRnZpZGVvJTJGNjYwNGMxODE2ZTg4Mzk1ZDdjNWQ5Njg4JnJlcz0xNC4zMSZybXRjPXQmc2NySGVpZ2h0PTk5OSZzY3JXaWR0aD0xOTI0JnNoaXA9JnNodT04ZDAxNjQ3MjY4YjYwMjA3MGZhMTJmYWU0NmE3MjA2YjdmMzRmN2IzM2ZiODc4NzAxZTAwMTg3YmJhYjgxYjgzMGVjZmY3YjZhOTc3NTM0MTNjMWQ1OGQxOWIwNjU0NjE1NWQ2MTQxMDkyZWZkNDIyOWY4Yjk4MDYyYTZjOGQ5ZTkyMzNmNjU2ZjE4MmM4NGY5MTllZDk1NGNmNGU4MmYxNzdmMTFiYTRiZWY5YjZlMDRlZGI2NTQyZGEmc3ViMz1pbnZva2VfbGF5ZXImdHo9MiZ2PTI0LjMuMzQ2MCZ4am5yeXY9MTM&uuid=&pii=&in=false HTTP/1.1
Host: channeldrag.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://channeldrag.com/api/users?token=L2M0MjEwYzI5P2tleT05Y2E2MDFhOWY0N2M3MzVkZjc2ZDVjYTQ2ZmEyNmE2NiZzdWJtZXRyaWM9MTc2NjM2ODk
Cookie: u_pl=17663689; ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxNzY2MzY4OSwiayI6IjAxZjc1YTk1YTM4YThkYjBhOGU4MmQ5OTUyNTNhMDc2Iiwic2lkIjoiQ0YtMzM2M19uZXdfMCIsImlzaWQiOjIsImFzaWQiOjEsInppZCI6MTk3OTY1OSwicGlkIjo1NDA2MDgsImFuIjp0cnVlLCJsYW4iOnRydWUsImNpZCI6MTYsImFpZCI6MjgsInB0Ijo0LCJwayI6ImM0MjEwYzI5IiwidCI6MX0sInUiOnsidSI6MSwiYXUiOjEsImQiOnsiaWQiOjc5OTU0MTk2LCJpZHMiOiIiLCJpYyI6ZmFsc2UsIm4iOiJEZXNrdG9wLEVtdWxhdG9yIiwidiI6IlVua25vd24iLCJtIjoiVW5rbm93biIsImYiOjEsImZuIjoiRGVza3RvcCIsIm9pZCI6MTgxMTAsIm9uIjoiTGludXgiLCJvdiI6IlVua25vd24iLCJiaWQiOjExNjY3MCwiYm4iOiJGaXJlZm94IiwiYnYiOiI5Ni4wIiwid3YiOmZhbHNlLCJlIjpmYWxzZSwiYWIiOmZhbHNlfSwiYyI6eyJpZCI6MTYyLCJjIjoiTk8iLCJuIjoiTm9yd2F5In0sImEiOmZhbHNlLCJjciI6eyJuIjoiQmxpeCBTb2x1dGlvbnMifSwieGYiOiIiLCJpeGYiOmZhbHNlLCJpZ3hmIjpmYWxzZSwidXAiOnRydWUsInIiOiJodHRwczovL3RoZWZhbnRhenkuY29tL3ZpZGVvLzY2MDRjMTgxNmU4ODM5NWQ3YzVkOTY4OCIsImFyIjpbXX19.dt6MHvD0PdMJ_9EUz7VmH4zLzbtLb_0UIKlgYTmpL94; cjs=t
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Server: nginx/1.21.6
Date: Sun, 31 Mar 2024 10:12:04 GMT
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Location: https://best-free-apps.com/preland/other/main/confirm/2/index.html?c=10378&u=28&p1=https%3A%2F%2Foohirdoadi.com%2Fdating-survey.html%3Fvar_3%3D377377824673a1ed2e720d2aa93c4abd%26ymid%3D1009861%26var%3D17663689%26testinapp%3D4455851%26geo%3D%257Bgeo%257D%26offer_id%3D2061%26b%3D20601807%26z%3D7251003%26nwimpr%3D1
Set-Cookie: iprcbc52acbba16fa3df10dc9ee13607f1a4=5122371; expires=Mon, 01 Apr 2024 10:12:04 GMT
pdhtkv=true; expires=Mon, 01 Apr 2024 10:12:04 GMT
uncs=1; expires=Mon, 01 Apr 2024 10:12:04 GMT
pdhtkv28=true; expires=Mon, 01 Apr 2024 10:12:04 GMT
uncs28=1; expires=Mon, 01 Apr 2024 10:12:04 GMT
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: ba2ad8d8e6571ea759865b062bddb481
Strict-Transport-Security: max-age=0; includeSubdomains

best-free-apps.com/preland/other/main/confirm/2/img/18.png

104.21.62.29

200 OK

4.7 kB

URL GET HTTP/3
best-free-apps.com/preland/other/main/confirm/2/img/18.png
IP
104.21.62.29:443
ASN
#13335 CLOUDFLARENET

Requested by
https://best-free-apps.com/preland/other/main/confirm/2/index.html?c=10378&u=28&p1=https%3A%2F%2Foohirdoadi.com%2Fdating-survey.html%3Fvar_3%3D377377824673a1ed2e720d2aa93c4abd%26ymid%3D1009861%26var%3D17663689%26testinapp%3D4455851%26geo%3D%257Bgeo%257D%26offer_id%3D2061%26b%3D20601807%26z%3D7251003%26nwimpr%3D1
Certificate
IssuerGoogle Trust Services LLC
Subjectbest-free-apps.com
FingerprintAB:BB:66:31:CE:4A:45:FE:5C:77:B5:5F:F4:2E:7F:01:24:74:BC:69
ValiditySun, 10 Mar 2024 00:23:48 GMT - Sat, 08 Jun 2024 00:23:47 GMT

File type
PNG image data, 120 x 120, 8-bit/color RGBA, non-interlaced
Size
4.7 kB (4652 bytes)
Hash
46cb3edc4a2ea526989b8c22ba6144bb
307edaf289185e85a5af9f777dade274c8e381b5
af583d4b34b8c7ea070531ba08a688388d35f9184891041edf6203a49d745bc3

HTTP Headers

GET /preland/other/main/confirm/2/img/18.png HTTP/1.1
Host: best-free-apps.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://best-free-apps.com/preland/other/main/confirm/2/index.html?c=10378&u=28&p1=https%3A%2F%2Foohirdoadi.com%2Fdating-survey.html%3Fvar_3%3D377377824673a1ed2e720d2aa93c4abd%26ymid%3D1009861%26var%3D17663689%26testinapp%3D4455851%26geo%3D%257Bgeo%257D%26offer_id%3D2061%26b%3D20601807%26z%3D7251003%26nwimpr%3D1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sun, 31 Mar 2024 10:12:05 GMT
content-type: image/png
content-length: 4652
last-modified: Tue, 19 Mar 2024 09:26:18 GMT
etag: "65f95a3a-122c"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: HIT
age: 101744
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=W3jhwtQgG8ZOHgZatI0kmhw5RQlwulqICF1hy6mQMFPobElKA1Q7qlH%2Bm4l4az5Aotd8jgOH%2FFaJ8QivZNYz%2B5vzJDaq0tLn9Mfn5n%2Fu7m0Wss77dAC%2FJqI9Uq7l4%2F22Djp9PZE%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 86cf8f1e2a5456a5-OSL
alt-svc: h3=":443"; ma=86400

best-free-apps.com/preland/other/main/confirm/2/index.html?c=10378&u=28&p1=https%3A%2F%2Foohirdoadi.com%2Fdating-survey.html%3Fvar_3%3D377377824673a1ed2e720d2aa93c4abd%26ymid%3D1009861%26var%3D17663689%26testinapp%3D4455851%26geo%3D%257Bgeo%257D%26offer_id%3D2061%26b%3D20601807%26z%3D7251003%26nwimpr%3D1

104.21.62.29

200 OK

7.7 kB

URL User Request GET HTTP/2
best-free-apps.com/preland/other/main/confirm/2/index.html?c=10378&u=28&p1=https%3A%2F%2Foohirdoadi.com%2Fdating-survey.html%3Fvar_3%3D377377824673a1ed2e720d2aa93c4abd%26ymid%3D1009861%26var%3D17663689%26testinapp%3D4455851%26geo%3D%257Bgeo%257D%26offer_id%3D2061%26b%3D20601807%26z%3D7251003%26nwimpr%3D1
IP
104.21.62.29:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services LLC
Subjectbest-free-apps.com
FingerprintAB:BB:66:31:CE:4A:45:FE:5C:77:B5:5F:F4:2E:7F:01:24:74:BC:69
ValiditySun, 10 Mar 2024 00:23:48 GMT - Sat, 08 Jun 2024 00:23:47 GMT

File type
HTML document, Unicode text, UTF-8 text
Size
7.7 kB (7689 bytes)
Hash
5a9221587893977b2aa5db06e63eebdb
722054a62d2187f018e0fc2330edb44fb8364247
52a0f49ee73cbc45a52a1ed4c9719052cd1ea8ff3e148e1598dc7b1b4a3d68a5

HTTP Headers

GET /preland/other/main/confirm/2/index.html?c=10378&u=28&p1=https%3A%2F%2Foohirdoadi.com%2Fdating-survey.html%3Fvar_3%3D377377824673a1ed2e720d2aa93c4abd%26ymid%3D1009861%26var%3D17663689%26testinapp%3D4455851%26geo%3D%257Bgeo%257D%26offer_id%3D2061%26b%3D20601807%26z%3D7251003%26nwimpr%3D1 HTTP/1.1
Host: best-free-apps.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://channeldrag.com/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sun, 31 Mar 2024 10:12:05 GMT
content-type: text/html
last-modified: Mon, 25 Mar 2024 14:26:00 GMT
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000, public
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ukAWKcQc0xWIQIcvFx9lNO%2FADkskkyJj0M3LPtkwD15vF8BoOdtXAuCJAVMI6Kk6nULdD5M6bgwJrudcNNF4bN8R2wla1Qju7DktjcJsJwMj8md23wXwltPKxqkbDgA0kkcAVpo%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 86cf8f1b5bb95699-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

locusflourishgarlic.com/pixel/preland?c=10378&e=1&u=28

172.240.127.234

200 OK

0 B

URL GET HTTP/1.1
locusflourishgarlic.com/pixel/preland?c=10378&e=1&u=28
IP
172.240.127.234:443
ASN
#7979 SERVERS-COM

Requested by
https://best-free-apps.com/preland/other/main/confirm/2/index.html?c=10378&u=28&p1=https%3A%2F%2Foohirdoadi.com%2Fdating-survey.html%3Fvar_3%3D377377824673a1ed2e720d2aa93c4abd%26ymid%3D1009861%26var%3D17663689%26testinapp%3D4455851%26geo%3D%257Bgeo%257D%26offer_id%3D2061%26b%3D20601807%26z%3D7251003%26nwimpr%3D1
Certificate
IssuerLet's Encrypt
Subjectlocusflourishgarlic.com
Fingerprint57:27:F8:05:C7:55:D6:CA:70:6A:14:49:EC:3E:21:ED:29:2B:66:F1
ValidityTue, 12 Mar 2024 06:53:50 GMT - Mon, 10 Jun 2024 06:53:49 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /pixel/preland?c=10378&e=1&u=28 HTTP/1.1
Host: locusflourishgarlic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://best-free-apps.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sun, 31 Mar 2024 10:12:05 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range

best-free-apps.com/preland/other/main/confirm/2/css/style.css

104.21.62.29

200 OK

6.0 kB

URL GET HTTP/3
best-free-apps.com/preland/other/main/confirm/2/css/style.css
IP
104.21.62.29:443
ASN
#13335 CLOUDFLARENET

Requested by
https://best-free-apps.com/preland/other/main/confirm/2/index.html?c=10378&u=28&p1=https%3A%2F%2Foohirdoadi.com%2Fdating-survey.html%3Fvar_3%3D377377824673a1ed2e720d2aa93c4abd%26ymid%3D1009861%26var%3D17663689%26testinapp%3D4455851%26geo%3D%257Bgeo%257D%26offer_id%3D2061%26b%3D20601807%26z%3D7251003%26nwimpr%3D1
Certificate
IssuerGoogle Trust Services LLC
Subjectbest-free-apps.com
FingerprintAB:BB:66:31:CE:4A:45:FE:5C:77:B5:5F:F4:2E:7F:01:24:74:BC:69
ValiditySun, 10 Mar 2024 00:23:48 GMT - Sat, 08 Jun 2024 00:23:47 GMT

File type
ASCII text, with very long lines (6765), with no line terminators
Size
6.0 kB (5997 bytes)
Hash
a305e4971ad05d6f1b97e40e637b2512
98eb0c4b63f73ab6fd1d5392f0637754989d1507
16a49396d1519bc928ee1e34184b4fe36579f22d482df33166cba94ecd897b89

HTTP Headers

GET /preland/other/main/confirm/2/css/style.css HTTP/1.1
Host: best-free-apps.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://best-free-apps.com/preland/other/main/confirm/2/index.html?c=10378&u=28&p1=https%3A%2F%2Foohirdoadi.com%2Fdating-survey.html%3Fvar_3%3D377377824673a1ed2e720d2aa93c4abd%26ymid%3D1009861%26var%3D17663689%26testinapp%3D4455851%26geo%3D%257Bgeo%257D%26offer_id%3D2061%26b%3D20601807%26z%3D7251003%26nwimpr%3D1
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Sun, 31 Mar 2024 10:12:05 GMT
content-type: text/css
last-modified: Tue, 19 Mar 2024 09:27:39 GMT
etag: W/"65f95a8b-176d"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: HIT
age: 101744
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=29Zzqvvcj1zJFA9S3yokbxcpn2hhGXPj2oTF963jC0eWWNvfqhV%2FUbpwzz5hOIVwLuyrPOigKQAVgq7Zu3XbINvVWvfgARZlvcwYQy1F%2Fr1m5sBZpQrHbvcLWDz4pMUwFuHaaII%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 86cf8f1e2a4956a5-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

best-free-apps.com/preland/other/main/confirm/2/img/favicon.png

104.21.62.29

200 OK

3.6 kB

URL GET HTTP/3
best-free-apps.com/preland/other/main/confirm/2/img/favicon.png
IP
104.21.62.29:443
ASN
#13335 CLOUDFLARENET

Requested by
https://best-free-apps.com/preland/other/main/confirm/2/index.html?c=10378&u=28&p1=https%3A%2F%2Foohirdoadi.com%2Fdating-survey.html%3Fvar_3%3D377377824673a1ed2e720d2aa93c4abd%26ymid%3D1009861%26var%3D17663689%26testinapp%3D4455851%26geo%3D%257Bgeo%257D%26offer_id%3D2061%26b%3D20601807%26z%3D7251003%26nwimpr%3D1
Certificate
IssuerGoogle Trust Services LLC
Subjectbest-free-apps.com
FingerprintAB:BB:66:31:CE:4A:45:FE:5C:77:B5:5F:F4:2E:7F:01:24:74:BC:69
ValiditySun, 10 Mar 2024 00:23:48 GMT - Sat, 08 Jun 2024 00:23:47 GMT

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Size
3.6 kB (3614 bytes)
Hash
ad372d754aa0e218c35dd3f5102548a7
5052a4d70604bbca30fa304dbc57b69d76d3230b
6c4a5582e76995f98a4de46c032094342da36963a71aee006eb0926580e0c0e3

HTTP Headers

GET /preland/other/main/confirm/2/img/favicon.png HTTP/1.1
Host: best-free-apps.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://best-free-apps.com/preland/other/main/confirm/2/index.html?c=10378&u=28&p1=https%3A%2F%2Foohirdoadi.com%2Fdating-survey.html%3Fvar_3%3D377377824673a1ed2e720d2aa93c4abd%26ymid%3D1009861%26var%3D17663689%26testinapp%3D4455851%26geo%3D%257Bgeo%257D%26offer_id%3D2061%26b%3D20601807%26z%3D7251003%26nwimpr%3D1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Sun, 31 Mar 2024 10:12:05 GMT
content-type: image/png
content-length: 3614
last-modified: Tue, 19 Mar 2024 09:26:18 GMT
etag: "65f95a3a-e1e"
cache-control: max-age=14400
cf-cache-status: HIT
age: 806
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CGDIjLBSwS0PZ7JccS6EcLdDdPSMax8weGhIWQiDL%2BtNQgmzMcC14rIx5ITPiyy69mu1DkFpN1XaHrbww3GvIthdOp2mn8B2rGUjjOavXxjfMM4p%2BOuQ4DwnJr%2BEECme83w4BXM%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 86cf8f1f4b7d56a5-OSL
alt-svc: h3=":443"; ma=86400

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (4)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (7)

URL

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

Certificate

File type

Size